RBAC V3 is an overarching framework that governs what an admin can do in the Netskope platform. It does not matter whether the admin is doing it via the UI or REST API.
Product capabilities are divided up into abstract functions. Every admin who logs in is assigned a role. And it is that role that defines, for each and every function, the permission the admin has:
- None – this role has no access to this function
- View – this role has read access to this function and can see but not change configuration or data under this function’s jurisdiction.
- Manage – this role has both read and write access to this function and can change configuration or data under this function’s jurisdiction
- Manage & Apply – this role has both read and write access to this function and can change configuration or data under this function’s jurisdiction. In addition, this role can make and apply changes immediately.
Policy Flavors
Some policy sets have multiple use cases rolled up into one, those use cases breaks up the policy into different functions because admins may want more specific control over which admins (roles) can manage which kind of policies.
For example:
- You only want your data compliance security team to create and define DLP policies, for both real-time and API-enabled protection.
- You only want your network security team to create firewall policies.
Real-time Protection Policy
- RTP Policy is broken up into various functions based on the traffic, like flavors of ice cream.
- DLP and Threat functions are additive functions, like toppings on the ice cream.
RTP Policy Flavors and Topping Definitions
| FLAVOR OR TOPPING | FUNCTION | DESCRIPTION |
|---|---|---|
| Ice cream FLAVOR | Cloud Apps Policy | Destination traffic is set to cloud apps or app instance. |
| Ice cream flavor | Web Policy | Destination traffic is set to categories. |
| Ice cream flavor | Firewall Policy | Destination traffic is set to at least one non-web app. |
| Ice cream flavor | Mail Relay Policy | Destination traffic is set to SMTP. |
| Ice cream flavor | NPA Policy | Destination traffic is set to private apps. |
| Ice cream flavor | DNS Policy | Destination traffic is set to DNS. |
| Ice cream TOPPING | DLP Policy | Has a DLP profile specified. |
| Ice cream topping | Threat Protection Policy | Has a TSS profile specified. |
| Ice cream topping | Browser Isolation Policy | Action is set to “Isolate.” |
API Data Protection Policy
- API policy has a single contextual policy function, like only one flavor of ice cream.
- DLP and Threat functions are additive functions, like toppings on the ice cream.
API Policy Flavors and Topping Definitions
| FLAVOR OR TOPPING | FUNCTION | DESCRIPTION |
|---|---|---|
| Ice cream FLAVOR | Policy | Any API Data Protection Policy |
| Ice cream TOPPING | DLP Policy | Has a DLP profile specified |
| Ice cream topping | Threat Protection Policy | Has a TSS profile specified |
Viewing Policies
The permission (None, View, Manage, Manage And Apply) works in conjunction with the policy flavors. This allows admins to control, very precisely, which admin users can manage which policies.
| PERMISSION | DESCRIPTION |
|---|---|
| Viewing and Managing Policies | Even if policies of different flavors show up in the same table, the rules described above still applies. Example 1: Admin use has “none” access to Mail Relay, NPA, and DNS Policy. They cannot not see these policies in the RTP policy table. Only the policies they have a minimum of “view” permission to show up in the table are visible to them. Example 2: Admin has “manage” permission to Cloud App Policy but only “view” permission to the other flavors. This means that despite being able to see all of the policies in the table, the admin user can only edit the ones meant for cloud app traffic. |
| Viewing Pending Changes | The pending changes an admin user can see is consistent with those that they have a minimum of “view” permission. This means, if admin user A has “none” access to DLP Policy, admin user A cannot see DLP policies in pending changes. Note, even if the admin user can view the pending changes, it doesn’t mean they can apply. This means, that an admin who has “manage” permission but not “apply” permission may submit approval to an admin who does. |
| Applying Changes | The pending changes an admin user can apply should be consistent with what they have “apply” permission on. This means, if there are more pending changes than what the admin user can apply, the admin user should be able to apply just the subset of pending changes they have access to. |
RBAC V3 Function Mapping
Product capabilities are divided into abstract functions. Every admin who logs in is assigned a role. And it is that role that defines, for each and every function, the permission the admin has:
Manage And Apply – this role has both read and write access to this function and can change configuration or data under this function’s jurisdiction. In addition, this role can make and apply changes immediately.
None – this role has no access to this function
View – this role has read access to this function and can see but not change configuration or data under this function’s jurisdiction.
Manage – this role has both read and write access to this function and can change configuration or data under this function’s jurisdiction
The following table is broken up by Function 1 and Function 2, product capabilities. Function 1’s permission depends on at least one or all of Function 2’s permission being set to a minimum permission.
In other words, you can’t set Function 1’s permission to R or R+W unless at least one or all of Function 2’s permission is set to a minimum permission or higher. Otherwise, Function 1 will not work correctly.
| FUNCTIONAL AREA | FUNCTION 1 | F1 PERMISSION | DEPENDS ON | FUNCTION 2 | F2 MINIMUM PERMISSION |
|---|---|---|---|---|---|
| Real-time Protection | DLP Policy | R+W | At least one | -Cloud Apps Policy -Web Policy -Firewall Policy | R+W |
| Real-time Protection | Threat Protection Policy | R+W | At least one | -Cloud Apps Policy -Web Policy -Firewall Policy | R+W |
| Real-time Protection | Browser Isolation Policy | R+W | N/A | Web policy | R+W |
| Real-time Protection | DNS Policy | R+W | At least one | -Web Policy -Firewall Policy | R+W |
| Real-time Protection | DLP Policy | R | At least one | -Cloud Apps Policy -Web Policy -Firewall Policy | R |
| Real-time Protection | Threat Protection Policy | R | At least one | -Cloud Apps Policy -Web Policy -Firewall Policy | R |
| Real-time Protection | Browser Isolation Policy | R | N/A | Web Policy | R |
| Real-time Protection | DNS Policy | R | At least one | -Web Policy -Firewall Policy | R |
| Real-time Protection | Cloud Apps Policy | R+W | All | -Users and Groups -Custom Apps -App Instance -Network Location Profile -Constraint Profile -HTTP Header Profile -File Profile -Device Classification -User Notification Template -Email Notification Template | R |
| Real-time Protection | Web Policy | R+W | All | -Users & Groups -Custom Category -URL List -Network Location -Constraint Profile -HTTP Header Profile -Device Classification -File Profile -User Notification Template -Email Notification Template -Forward to Proxy Integration | R |
| Real-time Protection | Firewall Policy | R+W | All | -Users & Groups -Service -Network Location Profile -User Notification Template -Email Notification Template | R |
| Real-time Protection | Mail Relay Policy | R+W | All | -Users & Groups -DLP profile -Email Notification Template -Constraint Profile | R |
| Real-time Protection | NPA Policy | R+W | All | -Users & Groups -Private Apps -Device Classification -User Notification Template | R |
| Real-time Protection | DNS Policy | R+W | All | -Users & Groups -DNS Profile -Network Location Profile | R |
| Real-time Protection | DLP Policy | R+W | All | -DLP Profile -Quarantine Profile | R |
| Real-time Protection | Threat Protection Policy | R+W | All | -Threat Protection Policy | R |
| Real-time Protection | Browser Isolation Policy | R+W | All | RBI Template | R |
| Real-time Protection | View All Policies | R | N/A | Policy Group | R |
| Real-time Protection | Cloud Apps Policy | R | N/A | Policy Group | R |
| Real-time Protection | Web Policy | R | N/A | Policy Group | R |
| Real-time Protection | Firewall Policy | R | N/A | Policy Group | R |
| Real-time Protection | Mail Relay Policy | R | N/A | Policy Group | R |
| Real-time Protection | NPA Policy | R | N/A | Policy Group | R |
| Real-time Protection | DNS Policy | R | N/A | Policy Group | R |
| Real-time Protection | DLP Policy | R | N/A | Policy Group | R |
| Real-time Protection | Threat Protection Policy | R | N/A | Policy Group | R |
| Real-time Protection | Browser Isolation Policy | R | N/A | Policy Group | R |
| Real-time Protection | Cloud Apps Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | Web Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | Firewall Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | Mail Relay Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | NPA Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | DNS Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | DLP Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | Threat Protection Policy | R+W | N/A | Policy Group | R |
| Real-time Protection | Browser Isolation Policy | R+W | N/A | Policy Group | R |
| API Data Protection | DLP Policy | R+W | All | -DLP Profile -Quarantine Profile -Legal Hold Profile | R |
| API Data Protection | DLP Policy | R+W | N/A | Policy | R+W |
| API Data Protection | Threat Protection Policy | R+W | All | -Threat Protection Profile -Quarantine Profile | R |
| API Data Protection | Threat Protection Policy | R+W | N/A | Policy | R+W |
| API Data Protection | DLP Policy | R | N/A | Policy | R |
| API Data Protection | Threat Protection Policy | R | N/A | Policy | R |
| API Data Protection | Policy | R | All | -Users & Groups -User Profile -Domain Profile -CASB API | R |
| API Data Protection | Policy | R+W | All | -Users & Groups -User Profile -Domain Profile -CASB API -Sensitivity Label -Quarantine Profile -Legal Hold Profile -Email Notification Template | R |
| DLP | Legal Hold Files | R | All | -CASB API -Legal Hold Profile | R |
| DLP | Quarantine Files | R | All | -CASB API -Quarantine Profile | R |
| DLP | Legal Hold Files | R+W | All | -CASB API -Legal Hold Profile | R |
| DLP | Quarantine Files | R+W | All | -Quarantine Profile | R |
| DLP | Quarantine Files | R+W | All | -CASB API | R+W |
RBAC V3 and Retro Scans
Retro Scan contains policies. If a retro scan contains any DLP policy, Netskope considers it a DLP retro scan. This also applies to Threat Protection.
The table below lists the retro scan action and the minimum permission required to run a retro scan for policies.
| Retro Scan Action | Minimum Permission |
|---|---|
| Start Scan | R+W |
| Pause Scan | R+W |
| Cancel Scan | R+W |
| Edit Scan | R+W |
| Clone Scan | R+W |
| Delete Scan | R+W |
| View Scan | R |
| Edit Policy | R+W |
| Clone Policy | R+W |
| Delete Policy | R+W |